# {{ ansible_managed }}
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

{% if (inventory_hostname in groups.webservers) or (inventory_hostname in groups.monitoring) %}
-A INPUT -p tcp  --dport 80 -j ACCEPT
{% endif %}

{% if (inventory_hostname in groups.dbservers) %}
-A INPUT -p tcp  --dport 3306 -j  ACCEPT
{% endif %}

{% if (inventory_hostname in groups.lbservers) %}
-A INPUT -p tcp  --dport {{ listenport }} -j  ACCEPT
{% endif %}

{% for host in groups.monitoring %}
-A INPUT -p tcp -s {{ hostvars[host].ansible_default_ipv4.address }} --dport 5666 -j ACCEPT
{% endfor %}

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
